Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.6, an information disclosure vulnerability exposes participant details, including names and email addresses through the /api/trpc/polls.get,polls.participants.list endpoint, even when Pro privacy features are enabled. This bypasses intended privacy controls that should prevent participants from viewing other users’ personal information. This issue has been patched in version 4.5.6.
References
| Link | Resource |
|---|---|
| https://github.com/lukevella/rallly/commit/59738c04f9a8ec25f0af5ce20ad0eab6cf134963 | Patch |
| https://github.com/lukevella/rallly/releases/tag/v4.5.6 | Release Notes |
| https://github.com/lukevella/rallly/security/advisories/GHSA-65wg-8xgw-f3fg | Exploit Vendor Advisory |
| https://github.com/lukevella/rallly/security/advisories/GHSA-65wg-8xgw-f3fg | Exploit Vendor Advisory |
Configurations
History
03 Dec 2025, 20:25
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
| First Time |
Rallly
Rallly rallly |
|
| CPE | cpe:2.3:a:rallly:rallly:*:*:*:*:*:*:*:* | |
| References | () https://github.com/lukevella/rallly/commit/59738c04f9a8ec25f0af5ce20ad0eab6cf134963 - Patch | |
| References | () https://github.com/lukevella/rallly/releases/tag/v4.5.6 - Release Notes | |
| References | () https://github.com/lukevella/rallly/security/advisories/GHSA-65wg-8xgw-f3fg - Exploit, Vendor Advisory |
01 Dec 2025, 14:16
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/lukevella/rallly/security/advisories/GHSA-65wg-8xgw-f3fg - |
29 Nov 2025, 01:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-11-29 01:16
Updated : 2025-12-03 20:25
NVD link : CVE-2025-66027
Mitre link : CVE-2025-66027
CVE.ORG link : CVE-2025-66027
JSON object : View
Products Affected
rallly
- rallly